1. Field of the Invention (Technical Field)
The present invention relates to the field of computer system security, more particularly to a dynamic data encryption and node authentication method and system that distributes the complexity of the encryption algorithm over the dynamics of data exchange and involves full synchronization of encryption key regeneration at system nodes, independent of the node clocks.
2. Background Art
The fundamental objective of cryptography is to enable users to communicate securely via an insecure shared data communication channel or system environment, maintaining data integrity, privacy, and user authentication. Over the past century, various cryptography systems have been developed which require a great deal of time to break even with large computational power. However, if an intruder obtains the encryption key, the encryption mechanism, and probably the entire system security, is compromised and a new key is required.
In order to make an encryption system nearly impenetrable to an intruder, two strategies are commonly used: 1) a long encryption key, and/or 2) a complex encryption function. A key of length n bits has a 2n search space. Therefore, for large values of n an intruder needs to spend more than a lifetime to break the cipher. Also, simpler encryption functions provide a less secure encryption system. For instance, an encryption code that applies the logic XOR function is easy to decipher no matter how long the key length is. This is because the XOR operation is performed on one bit of data and its corresponding bit from the encryption key, one bit at a time. The deciphering approach of such simple encryption functions by an intruder is based on the divide-and-conquer mechanism. The intruder first deciphers individual key fragments, which is relatively uncomplicated to accomplish due to the simple linearity of the XOR function, then reconstructs the entire key once all of the individual fragments are obtained. It is more difficult to apply such a divide-and-conquer approach to break the key of a nonlinear exponential encryption function, such as used in the Rivest-Shamir-Adelman (RSA) system.
At present, there are two major cryptography system philosophies: 1) symmetric systems (static or semi-dynamic key), and 2) public key systems (static key). In symmetric systems, e.g., DES, AES, etc., a key is exchanged between the users, the sender and receiver, and is used to encrypt and decrypt the data. There are three major problems with symmetric systems. First, exchanging the key between users introduces a security loophole. In order to alleviate such a problem, the exchanged key is encrypted via a secure public key cryptography system. Second, the use of only one static encryption key makes it easier for an intruder to have an ample amount of time to break the key. This issue is addressed by the use of multiple session keys that are exchanged periodically. Third, and more importantly is the susceptibility to an “insider” attack on the key. This is referred to as the “super user” spying on the “setting duck” static key inside the system, where the time window between exchanging keys might be long enough for a super user, who has a super user privilege, to break in and steal the key.
In the RSA public key cryptography system, a user (U) generates two related keys, one is revealed to the public, deemed the “public” key, to be used to encrypt any data to be sent to U. The second key is private to U, called the “private” key, and is used to decrypt any data received at U, which was encrypted with the corresponding public key. The RSA cryptography system generates large random primes and multiplies them to get the public key. It also uses a complex encryption function such as mod and exponential operations. As a result, this technique is unbreakable in the lifetime of a human being for large keys, e.g., higher than 256 bits, and also eliminates the problem of the insecure exchange of symmetric keys, as in a DES system. However, the huge computational time required by RSA encryption and decryption, in addition to the time required to generate the keys, is not appealing to the Internet user community. Thus, RSA cryptography is mainly used as “one shot” solid protection of the symmetric cryptography key exchange.
In the RSA public key system, if a first user (UA) requests a secure communication with a second user (UB), the latter will generate a pair of encryption keys: public EB and private DB. An internal super user spy (S), with a helper (H) intruding on the communication line externally, can easily generate its own pair of keys, a public ES and private DS, and pass DS and EB to H. Then S can replace the public key EB with its own public key ES. Thus, all data moving from UA to UB will be encrypted using ES instead of EB. Now H can decrypt the cipher text moving between UA and UB using the private key DS, store it, and re-encrypt it using the original EB, in order for UB to receive and decrypt it without any knowledge of the break that occurred in the middle. Such an attack is typically called the “super-user-in-the-middle” attack.
Even though they are secure against outsider attack, both the symmetric and public key cryptography systems are still vulnerable to insider attacks. By obtaining the key at any time of a secure session, an intruder can decipher the entire exchanged data set, past and future. Further, a super user can easily steal a static symmetric key and send it to an outside intruder to sniff and decrypt the cipher text, particularly in the DES and AES systems.
A common way to protect a static encryption key is to save it under a file with restricted access. This restriction is not enough, however, to prevent a person with super-user privilege from accessing the static key in the host file. Even when keys are changed for each communication session, for example in the Diffie-Hufman system, there is a time window enough for the super-user to obtain the semi-static key. In most crypto systems, once the key is found the previous and future communicated data are no longer secure.
Various other attempts have been made to circumvent intrusion by outside users through encryption of communicated data. Examples of such methods include that described in U.S. Pat. No. 6,105,133 to Fielder, et al., entitled, “Bilateral Authentication and Encryption System;” U.S. Pat. No. 6,049,612 also to Fielder, et al., entitled, “File Encryption Method and System;” and U.S. Pat. No. 6,070,198 to Krause, et al., entitled, “Encryption with a Streams-Based Protocol Stack.” While the techniques described in these patents may be useful in preventing unwanted intrusion by outsiders, they are still prone to attack by the super-user-in-the-middle.
The present invention alleviates the problems encountered in the prior art, providing continuous encryption key modification. A new key is generated from a previous key as well as from a previously encrypted data record. The regenerated key is then used to encrypt the subsequent data record. The key lifetime is equal to the time span of record encryption, reducing the possibility that an intruder will break the key or that a super-user will copy the key. The present invention also alleviates the “super-user-in-the-middle” attack. An intruder must obtain an entire set of keys, at the right moment, without being noticed, in order to decrypt the entire ciphered message.
The present invention also reduces computational overhead by breaking the complexity of the encryption function and shifting it over the dynamics of data exchange. Speed is also improved through the use of a simple XOR logic encryption function. A shuffling mechanism based on a dynamic permutation table, which is generated from the current session key, is coupled with the XOR logic operation, to strengthen the encryption function. Encryption is fully automated and all parties, the source user, destination user, and central authority, are clock-free synchronized, and securely authenticated, at all times. The dynamic key encryption system of the present invention is deployable at any level of a system, as there is complete synchronization between parties.
The present invention further eliminates the possibility of an intruder obtaining additional keys, and therefore additional data, in the circumstance where an intruder is able to break one of the keys.
A previously encrypted data record is combined with a previous key to create a new key for encrypting a subsequent data record. Hence, if an intruder were to break one key, the intruder could only decrypt its corresponding data record and nothing more, past or future ciphered data.